Today I noticed that my bash history is cleared completely. I have neither executed history -c
nor deleted the .bash_history
file. Apart from deleting the .bash_history
file and history -c
, how can bash history be cleared?
2 Answers
When closing multiple bash instances at the same time, there is a known race condition that may cause the history to be cleared. This occurs because there is no locking used when the bash history file is written.
Chet Ramey (the current bash maintainer) gave a good summary of the conditions for this issue:
The current (bash-4.3-devel) code works something like this, assuming no errors (lib/readline/histfile.c:history_do_write()):
- rename (histfile, histfile~)
- open file with O_CREAT|O_TRUNC
- malloc buffer large enough to hold all history data
- write all of the history entries in one write(2) call
- close file
- unlink (histfile~)
The bash-4.2 code works the same way except that it does not back up the history file. Each shell does the same thing when it exits, assuming histappend is not set, as in your configuration.
There are a couple of ways the history file can end up zero-length: the malloc can fail, or the write can fail. In bash-4.2, it's too late to do anything about the truncated history file at that point. In bash-4.3, the previous history file will be restored.
This mailing list thread from bug-bash contains a decent discussion of the problems, possible solutions, and concerns surrounding this.
There are also some other possibilities:
- At some point, your
HISTSIZE
orHISTFILESIZE
was set to 0 - At some point, your readline
history-size
was set to 0 - Someone, whether intentionally or unintentionally, wiped the bash history (via
> "$HISTFILE"
or similar)
In the latter case, you might want to check that someone hasn't been accessing your account and is trying to hide their tracks in a crude way. Take a look at last
, /var/log/auth
(or /var/log/secure
on CentOS/RHEL), and if you have it, any process accounting and/or auditing software you may have installed.
-
can you stop bash saving history on close, but save to the history when a command is run? (the latter i already have set up) Dec 6, 2020 at 22:39
How I accidentally deleted my bash history:
I was rolling my own alternative terminal readline script from first principles: https://tiswww.cwru.edu/php/chet/readline/rluserman.html
and then testing it out in a terminal. That GNU Readline has a history size and history preservation instructions built in, so hist size can be defaulted, and thus all your history is blown away.
Recovery of history if left in memory:
If you catch it before a reboot, or if a terminal was left open from before the clear, you might be able to find your history in memory. Run history | cut -c 8- > histback_user1.txt
on all terminals left open and for every user. If that produces a file with your extended history, then you can replace ~/.bash_history
with histback_user1.txt
. Also check the history of all users recently logged into the system as well as root's history. It's easy to accidentally clear the bash history under many circumstances, so if you want to be sure of no loss of history, you need a daily backup script.
-
Thank you. I don't know what the hell happened, but my history got resetted yesterday and it wasn't until now that I noticed it. But, lucky me, I had not one terminal window open, but 10 (!). It's all good now. Dec 2, 2019 at 6:15
>.bash_history
. Maybe someone was in your account and tried to hide his trails. Check for unusual login times withlast
, search thru/var/log/auth.log
(depending on your system).